One idea here related to some of @david’s scoping work is that we could make a user api key that is tightly scoped to a single RSS feed, that way the surface area is low, and in cases like that where we have an ultra scoped user api key we could allow it without headers (a column on user_api_key to say this key is can use GET for auth).
The challenges here are:
-
We don’t have a mechanism for users to generate user api keys, we would have to build something for the RSS use case which would involve some new UX, not sure where we would even add it, in the user profile maybe, I don’t know.
-
We don’t have a mechanism to scope down just to one specific RSS feed which we would have to add
-
We don’t have a flag for “allowed user API key” via URL GET params which would be required for this
Overall I see this as something we could solve but we are probably looking at a week or two of work here to get it working just right.
The upside is that some of this work is work we want to do regardless of RSS, but the downside is that some of the work is very tightly coupled to RSS and there are very few people who use this feature these days.
Up to @codinghorror I guess to choose how we want to prioritize this.